@comput/pi-intercom 0.6.1 → 0.9.0

package/README.md

@@ -26,6 +26,10 @@ The value is the loop: **delegate → report back → evaluate → decide the ne
 >
 > **0.5.1:** manually closed workers remain registered and sort last as disconnected in the monitor. Optional JSON health checks and guarded resume preserve the distinction between connectivity and saved session identity.
 >
+> **0.8.0:** Config is restricted to the session working directory. No parent search or explicit-parent override; shared-config subfolder launches are refused.
+
+> **0.7.0:** Coordinator-local five-minute reminders follow worker calls. Use `intercom_stop_reminders` when nothing needs follow-up. Busy periods are skipped; shutdown/reload clears the timer.
+
 > **0.6.1:** Linux Herdr background save-handoff-and-close workflow, with saved public summaries in config and monitor/JSON details. Empty rosters no longer open a monitor; coordinator session/tab names are preserved.
 
 For potential next steps, see [Improvement topics](references/roadmap.md). These are proposals for discussion, not implemented features or release commitments.
@@ -100,13 +104,17 @@ Linux `multiplexer: none` is explicitly unsupported: no terminal guessing, headl
 
 ### Startup and launchers
 
-Without shared config, the current working directory becomes the coordinator root. Startup creates `.pi-intercom/config.json`, opens a loopback listener, synchronizes the name `Coordinator`, and waits for user input (no model turn). Existing config is found by walking upward. Invalid/unreadable config is an error and is not overwritten. Unknown session IDs, including forks, are workers, never replacement coordinators.
+**Strict root isolation (0.8.0):** The session's starting working directory is its config root. An explicit flag cannot widen this boundary. Only `<root>/.pi-intercom/config.json` is considered: there is no upward search, Git-root inference, or home-directory fallback. If that exact config is absent, startup creates a local coordinator config, opens a loopback listener, preserves the session/tab name, and waits for user input (no model turn). Invalid/unreadable local config is an error and is not overwritten. A session ID absent from an existing selected config, including a fork, is a worker, never a replacement coordinator.
+
+Created/resumed workers receive `--intercom-root /absolute/session/root` explicitly as a same-directory assertion, **not permission to read a parent config**. The supplied root must canonically equal the session working directory, and its exact config must already exist. A mismatched root is rejected before reading its config or creating startup resources. No environment variable selects a parent root. Shared-roster workers must start in the coordinator's root; create/resume requests for subfolders are rejected before launch instead of silently changing the working directory. Linked metadata/config paths that escape the root and stable redirects of an already validated root are rejected. Monitor/logging readers retain stricter rules and may reject even internal links. These guards cover config access and temporary-config cleanup. They do not sandbox all filesystem I/O, pin an already-running telemetry writer after filesystem changes, or provide an atomic defense against concurrent filesystem replacement.
 
-Default launcher `herdr` requires the coordinator to be inside Herdr (`HERDR_ENV=1` and workspace context), with `herdr` on PATH. Windows needs `powershell.exe` plus `pi.ps1` in the worker pane; Linux needs `sh` plus `pi`. Each worker gets **one tab, one pane, no split, no focus change**. The Windows-only `none` launcher requires `pi.cmd` and Windows PowerShell on PATH and opens a separate visible PowerShell terminal. Missing launcher is an error, not fallback. Launch acknowledgment means command submission/terminal creation, not Pi readiness. A failed launch can leave a tab or process behind; no automatic cleanup occurs. See the scoped live evidence below.
+**Upgrade note:** Existing subfolder workers cannot rejoin a parent roster by supplying a flag. Their saved history/config entries are retained, but launching them in a subfolder with the parent's config is refused. Use workers whose configured directory is the coordinator root, and explicitly describe any subfolder work in their assignment. Independent sessions started in subfolders use only their own local config; ancestor files are left untouched.
+
+The `herdr` launcher selects the new core when `HC_TERMINAL_ID` is present; see [new Herdr compatibility](#new-herdr-coreapp-compatibility). For the **legacy backend**, the coordinator must be inside Herdr (`HERDR_ENV=1` and workspace context), with `herdr` on PATH. Windows needs `powershell.exe` plus `pi.ps1` in the worker pane; Linux needs `sh` plus `pi`. Each worker gets **one tab, one pane, no split, no focus change**. The Windows-only `none` launcher requires `pi.cmd` and Windows PowerShell on PATH and opens a separate visible PowerShell terminal. Missing launcher is an error, not fallback. Launch acknowledgment means command submission/terminal creation, not Pi readiness. A failed launch can leave a tab or process behind; no automatic cleanup occurs. See the scoped live evidence below.
 
 ## Explicit workflow
 
-1. Coordinator calls `intercom_create_worker({projectDirectory:"."})`. No worker identity, responsibility, callback address or special config path is passed.
+1. Coordinator calls `intercom_create_worker({projectDirectory:"."})`. The launcher passes the same-directory root assertion; no worker identity, responsibility or callback address is passed.
 2. Anonymous worker opens its own endpoint and sends its session ID, actual port and root-relative project directory to coordinator Pi. Registration starts a normal coordinator turn when idle or queues steering when busy. It creates **no config entry or hidden pending-registration map**.
 3. Coordinator decides and calls `intercom_configure_worker` with **all five explicit fields**: `sessionId`, `port`, `projectDirectory`, `name`, `description`. This only writes config.
 4. Coordinator separately calls `intercom_reload_worker({to:"Builder"})`. Worker rereads responsibility and synchronizes Pi/Herdr tab names. **This is not Pi `/reload`, a restart, cancellation, or work assignment.** No model turn starts.
@@ -121,13 +129,14 @@ Every tool rereads current config and checks the live Pi session ID. Names are c
 
 | Tool | Arguments | Permission / effect |
 |---|---|---|
-| `intercom_create_worker` | `projectDirectory?` (default `.`) | Coordinator; launch anonymous worker |
+| `intercom_create_worker` | `projectDirectory?` (default `.`) | Coordinator; launch anonymous worker at the same root only |
 | `intercom_configure_worker` | `sessionId`, `port`, `projectDirectory`, `name`, `description` | Coordinator; all five explicit fields, writes only |
 | `intercom_reload_worker` | `to` (worker name) | Coordinator; passive config/name reload |
 | `intercom_send` | `to` (name), `message` | Configured, responsibility-loaded sessions; asynchronous message |
 | `intercom_list` | None | Configured coordinator/workers; saved roster, never live health |
 | `intercom_worker_status` | `name?`, `offset?`, `limit?`, `probe?` | Configured sessions; local JSON by default, optional bounded endpoint checks for returned page |
 | `intercom_request_status` | `to` (worker name) | Coordinator; independent extension report |
+| `intercom_stop_reminders` | None | Coordinator; disable reminder timer until another qualifying worker call, without cancelling work |
 | `intercom_report_status` | None | Workers including anonymous; shared report function, never registration |
 | `intercom_report_work` | `status`, `summary?` | Configured, responsibility-loaded workers; save a public report and notify coordinator, never approve/complete work |
 | `intercom_stop_worker` | `to` | Unsupported graceful cancellation; no side effects |
@@ -136,11 +145,35 @@ Every tool rereads current config and checks the live Pi session ID. Names are c
 | `intercom_resume_worker` | `to`, `confirmClosed` | Coordinator; user-confirmed old-session closure, saved session/launcher/directory, guarded launch |
 | `intercom_remove_worker` | `to` (worker name) | Coordinator; config entry only, no shutdown/session deletion |
 | `intercom_set_multiplexer` | `multiplexer`: `herdr` or `none` | Coordinator; future launches only |
+| `intercom_open_monitor` | Required `placement`: `coordinator-tab` or `new-tab` | Coordinator; open/preserve the Herdr monitor; ask the user if placement is unknown, never infer it from saved settings; allows an empty roster |
+| `intercom_close_monitor` | None | Coordinator; close only the verified owned monitor pane, never worker panes or a whole tab |
+| `intercom_configure_monitor` | `autoOpen?`, `placement?` (at least one) | Coordinator; persist startup/reload preferences only; does not open, close or move existing panes |
 
 **Removal precondition:** close a running worker before removing its entry. Removal forgets the registration; it is not how to park a worker for later resume. Active/uncertain close jobs fence removal and other lifecycle/work operations. Saved IDs/ports alone do not prove closure; no force-kill fallback occurs.
 
 Anonymous `send`/`list` and all coordinator operations fail explicitly. Anonymous registration and status remain available. A dedicated repeat-registration operation and broader anonymous permissions remain **unresolved contract TODOs**, not silently added tools. If initial registration fails, the worker remains reachable and reports the error locally. Explicit user Pi `/reload` restarts this extension and repeats startup registration; status is not a substitute and there is no automatic retry.
 
+### Coordinator reminders (0.7.0)
+
+A coordinator-local timer wakes an idle agent to review delegated work. It is **not** an endpoint health ping, task assignment, worker retry, or crashed-process watchdog. It starts disarmed and does not change shared config or the wire protocol.
+
+- Valid coordinator calls to create, configure, resume, reload, request status from, message, or close a worker start/reset the timer **before the attempted operation**. A subsequent operation failure can still need follow-up, so it does not automatically cancel the timer.
+- Every five minutes, recheck coordinator identity and whether Pi is idle. Busy ticks are skipped, not queued. Worker replies, incoming reports, list/JSON status reads (including probes), and worker-to-worker/coordinator messages do not reset it.
+- `intercom_stop_reminders({})` disables reminders until the next qualifying call. It does not cancel workers, close jobs or model work. There is no automatic reminder-count cutoff.
+- Timers are in memory only. Shutdown, Pi `/reload`, or session replacement disposes them; startup does not restore or replay them. Reset/stop invalidates stale callbacks and older in-flight calls cannot re-arm after a later stop.
+- Aborting the owning tool's Pi run also disarms its reminder generation when that AbortSignal is available. This is **not universal Escape/Stop detection**: the host may later be in a separate retry/compaction run whose abort does not reach the original signal. Use the explicit stop tool to disable reminders reliably.
+- Reminder delivery uses Pi's existing user-message path. Host input rejection remains possible (including the documented compaction gap); reminders are not immediately retried. The next normal tick is a new periodic check, not proof of prior delivery.
+
+The reminder contains only this fixed public text, never task payloads or private reasoning:
+
+> Intercom reminder: Review outstanding delegated work and worker reports. If follow-up is needed, take the next appropriate action. Do not assume workers have finished or stopped.
+>
+> If there is genuinely nothing to follow up on, call `intercom_stop_reminders`. Otherwise, reminders continue every five minutes; a new worker call resets the timer.
+>
+> This reminder does not authorize new work, retries, worker closure, or publication.
+
+Reload the coordinator's extension to register the new tool and timer logic. No existing live session is armed merely by installing the change.
+
 ## Config and wire contracts
 
 Shared, source-controlled file: `<root>/.pi-intercom/config.json`. Do not ignore it or split IDs/ports into runtime config. Example **schema only** (not automatically installed placeholder data):
@@ -182,9 +215,43 @@ Version 0.2.0 telemetry adds an optional envelope `correlationId` for one transp
 
 Tool text output is bounded to 50 KiB/2000 lines. The full saved roster remains in the shared config file. Name sync errors are surfaced; startup retains the useful endpoint, and explicit reload reports failure (Pi name/responsibility may already have changed before a Herdr tab rename fails).
 
+## New Herdr core/app compatibility
+
+Intercom now detects `HC_TERMINAL_ID` and uses the reviewed **herdr-core 0.1.18** protocol. The Windows UI can be local or connected to a Linux/Windows core. Worker creation/resume, actual tab names, and monitor layout use a single verified core connection and the machine-owned `herdr-app` document. This is a source-backed adapter for the **herdr-app 0.1.13 layout format**, not a public versioned tab API. Unsupported layouts (including stacks and terminal floats) fail closed. Shared-state confirmation is not proof that a remote window rendered it.
+
+Configured workers rename their own actual tab on startup/reload; the coordinator retains its title (for example, **Main**). New workers get a dedicated tab in the coordinator's space. No provider/model override or initial task is injected. Core launches retain independent worker lifetimes; creating a terminal is not proof of Pi readiness.
+
+Unix connects directly to the existing core socket without starting a server. `HC_SOCKET` selects an explicit endpoint; otherwise documented default paths are used only when no core config file is present. If a config file could override the socket, set `HC_SOCKET` explicitly. Windows uses the reviewed existing-core status preflight; a core disappearing between preflight and connect is not an atomic no-autostart guarantee. Legacy `HERDR_*` support remains selected only by explicit legacy context, never as fallback after an HC error.
+
+Monitor open/close supports both core platforms. Close refuses observed live descendants, persists a pending fence, revalidates ownership, stops the owned monitor once and removes only its layout pane. Core termination can cascade to dependent terminals: another client concurrently attaching children is outside the non-atomic preflight guarantee. Worker handoff-close remains Linux-only, requires session-header/PID-start proof and the existing persistence/settlement/commit checks, and likewise refuses observed live descendants. Neither close promises atomic quiescence or an all-descendants guarantee. Uncertain operations are not replayed.
+
+Old monitor ownership records are not converted into new-core ownership. They require inspection before removal; Intercom will not adopt or delete an unknown pane. See [migration validation and limitations](references/herdr-core-migration.md).
+
 ## Standalone terminal status monitor
 
-When at least one worker is registered, the coordinator automatically checks for its monitor pane on startup inside Herdr. If missing, it creates a small pane **above the coordinator**, preserving coordinator focus. With no workers, it does not create/check the monitor. Configuring the first worker triggers the check; disconnected saved workers still count. This does not automatically close an already-existing monitor when the final worker is removed. This is a standalone Node/pi-tui program, **not another Pi instance**. The old inline widget implementation has been removed. Source installations must run `npm run build` before reloading Pi; published packages include the compiled `dist/monitor.js` entry.
+By default, when at least one worker is registered, the coordinator automatically checks for its monitor pane on startup/reload inside Herdr. If missing, it creates a small pane **above the coordinator**, preserving coordinator focus. Set `monitor.autoOpen` to false to disable automatic opening, or set `monitor.placement` to `new-tab` to use a separate tab instead. With no workers, it does not create/check the monitor. Configuring the first worker triggers the check; disconnected saved workers still count. This does not automatically close an already-existing monitor when the final worker is removed. This is a standalone Node/pi-tui program, **not another Pi instance**. The old inline widget implementation has been removed. Source installations must run `npm run build` before reloading Pi; published packages include the compiled `dist/monitor.js` entry.
+
+### Explicit monitor controls and saved preferences
+
+```js
+intercom_configure_monitor({ autoOpen: true, placement: "new-tab" })
+intercom_open_monitor({ placement: "new-tab" }) // Explicit choice required, even with no workers.
+intercom_close_monitor({}) // Only the verified monitor pane.
+intercom_open_monitor({ placement: "coordinator-tab" }) // One-off placement override.
+```
+
+The optional project-config section is:
+
+```json
+"monitor": {
+  "autoOpen": true,
+  "placement": "coordinator-tab"
+}
+```
+
+Older configurations without this section retain the defaults above. Configuration updates affect future automatic opening, not an existing pane. Explicit `intercom_open_monitor` calls must always supply `placement` as a string. The tool schema intentionally has no enum; its description lists the currently supported strings (`coordinator-tab` and `new-tab`), and runtime validation rejects unsupported values. If the agent does not know the user's choice, it must ask rather than guess or use the saved preference. The explicit placement does not change the saved automatic-opening preference. If the monitor already exists in a different placement, close it first; Intercom does not relocate it or create a duplicate. A manual close invalidates earlier automatic-opening requests, but does not disable `autoOpen`: a later startup/reload can reopen it when workers are registered. To keep it closed, disable automatic opening too. Concurrent operations may report a lock or partial-operation fence instead of succeeding; they are not automatically retried. Preferences are checked at automatic admission, not an atomic cancellation of an already-submitted Herdr command.
+
+Both placements preserve coordinator focus. New-tab placement creates a monitor pane in its own tab; close targets that recorded pane only, even if other panes were later added to the tab or the saved placement preference changed. Ownership uncertainty or partial creation/closure requires inspection, not blind retries. Legacy panes adopted from their label alone are not authorized for tool-driven closure; they require manual inspection. Close rechecks ownership before submitting one pane-close request and observes pane absence afterward; Herdr does not provide an atomic compare-and-close operation, and pane absence does not prove all child processes exited. Monitor controls do not arm worker-follow-up reminders and do not stop workers.
 
 The table uses aligned **Worker | Connection | Report | Activity | Seen | Last activity** columns (activity age/detail give way first on narrow panes). Report is explicitly worker-authored and separate from host activity. Activity is the last reported `working`, `thinking`, `idle`, `closed`, or `unknown` state. Seen marks evidence older than 60 seconds with `(old)`; this is not a live connection indicator. Last activity uses fixed public labels such as Reading files, Running command or Writing response and can persist after the worker settles. Recent working/thinking/idle observations use restrained colors; old evidence remains neutral and explicitly marked. `NO_COLOR` disables styling. Version 0.5.2 adds a small footer label for the Intercom package version loaded by the monitor at startup; restart the monitor after updating to load the new version. Narrow panes use a compact version label and preserve the quit hint. No read-only banner or busy/idle count summary is shown. It reads the bounded config/log snapshot and performs read-only loopback health checks, then refreshes roughly three seconds after completion, without worker prompts or model calls. Checks are bounded by 750 ms per endpoint, a four-second batch budget, 16 concurrent requests and 256 workers; no overlapping batches or retries. Closing the monitor aborts checks. Only observed activity is shown, not inferred assignments/completion. Evidence over 60 seconds old is stale; missing evidence is unknown. The number of worker rows adapts to the pane height, with an omitted count when needed. The display is clipped to pane dimensions. In the monitor pane, use **↑/↓** to select a worker and **Enter** to toggle its details (configured responsibility and observed status). Selection follows the worker across roster reorder and scrolls the visible window. **Escape** closes details first, then quits; **q** or **Ctrl+C** always quits only the display process, never agents or their panes.
 
@@ -264,6 +331,7 @@ Run these commands from a source checkout; tests and workflows are not shipped i
 npm ci
 npm run typecheck
 npm test
+npm audit --audit-level=low
 npm run check:package
 # Optional installed-host compatibility probe (confirms the known defect):
 PI_INTERCOM_PI_ROOT='C:/path/to/pi-coding-agent' npm run test:host
@@ -273,11 +341,48 @@ The extension source runs through Pi's TypeScript loader; `npm run build` genera
 
 ## Publishing
 
-[`.github/workflows/publish.yml`](https://github.com/comput-sh/pi-intercom/blob/main/.github/workflows/publish.yml) publishes through npm Trusted Publishing (GitHub OIDC), without an npm token secret. Configure the npm trusted publisher as owner `comput-sh`, repository `pi-intercom`, workflow `publish.yml`, with no environment.
+[`.github/workflows/publish.yml`](https://github.com/mbundgaard/pi-intercom/blob/main/.github/workflows/publish.yml) publishes **only on pushed version tags**. Ordinary commits, GitHub Release publication and manual dispatch do not publish. It checks out the triggering SHA, requires an annotated stable `vX.Y.Z` tag, and verifies the tag matches the package version and both lockfile version fields before installing dependencies.
+
+Windows/Linux validation includes a clean install, typecheck, tests, full-tree security audit and package checks. The publisher packs and preserves an exact archive, publishes it with npm Trusted Publishing/OIDC and provenance (no stored npm token), then verifies the registry archive and decoded provenance linkage. Configure/check npm's trusted publisher as owner `mbundgaard`, repository `pi-intercom`, workflow `publish.yml`, no environment, with direct `npm publish` allowed.
+
+Follow the [release procedure](references/releasing.md): review → choose an unused version/tag → update versions and changelog → validate → obtain explicit authorization → commit/push main → verify CI → create an annotated tag on that exact commit → push only that tag. Never trigger a second publisher, move tags, reuse published versions or blindly retry uncertain publication. Report success only after registry/artifact/linkage verification. Publishing does not install the extension or reload running sessions.
+
+The tag-only workflow is a source change for future releases; historical tags retain their original workflow snapshots. Any security findings must be resolved before the audit gate can pass.
+
+### 0.9.0 — new Herdr core/app integration
+
+- Add explicit string-placement monitor tools and saved automatic-opening preferences.
+- Add core-backed worker launch/resume, actual remote tab naming and monitor layout, preserving coordinator names and focus state.
+- Add guarded monitor closure and Linux worker handoff-close for the new core, with identity checks, descendant refusal, CAS and uncertainty fences.
+- Isolate adapter tests from inherited live `HC_*`/`HERDR_*` identities; a fixture must never rename a real tab.
+- Update the development SDK's scoped `minimatch` override to 11.0.1 to address the new audit advisory; installed dependency and compatibility tests are checked separately.
+- Native Windows execution and remote-window rendering remain acceptance checks, not claims established by mocked tests.
+
+### 0.8.1 Tag-only releases and dependency security updates
+
+- Publish only from pushed, annotated stable version tags, with exact-commit and package/lockfile version checks. GitHub Release and manual-dispatch publication triggers are removed.
+- Add full-tree security audit gates to main/PR CI and release validation.
+- Upgrade the development SDK to Pi 1.4.0 with a scoped `undici` 8.12.2 override and patched `brace-expansion` 5.0.12. Verify actual installed dependency versions as well as a clean audit; Pi 0.84.4's shrinkwrap prevented effective overrides. The runtime TUI alias stays at 0.84.4 and the Node minimum remains 22.19.0. This does not upgrade users' installed Pi.
+- Keep handoff reporting model-only on newer SDKs: nested calls lack the transcript tool-result evidence required for closure. Existing final-settlement and persistence checks remain unchanged.
+- Preserve and publish one archive using npm Trusted Publishing/OIDC, then compare the registry download and decoded provenance linkage against the release build.
+- Document explicit release authorization, immutable tags, uncertain-publication handling, and installation/reload separation in [the release procedure](references/releasing.md).
+- Includes the coordinator reminders and strict session-root isolation from the preserved, unpublished 0.7.0/0.8.0 tags. Shared-roster subfolder worker launches are refused rather than redirected to parent configuration.
+
+### 0.8.0 Strict session-root isolation
+
+- Never search parent folders for config, even when a local config is missing or malformed. An explicit root must canonically equal the session working directory; it cannot permit a parent config.
+- Validate before startup resources, reject escaping/dangling config links and stable root redirects, and guard temporary-config cleanup. These are config protections, not a filesystem sandbox or atomic TOCTOU guarantee.
+- Created/resumed workers receive an explicit same-directory root assertion. Shared-config subfolder launches are now rejected, not silently relocated. Existing registrations/history remain intact.
+- Includes the coordinator reminders from the preserved 0.7.0 GitHub release, whose npm publication was blocked by authorization after the repository transfer.
+- Local validation: 205 tests, typecheck and isolated package-install checks passed. Native Windows/Linux CI gates publication.
 
-The workflow validates on Windows and Linux, then publishes with provenance from a GitHub-hosted Ubuntu runner. It runs when a GitHub release is published or when manually dispatched. Release tags must be `v<package.json version>`.
+### 0.7.0 Coordinator reminders
 
-Published versions are immutable. For a new release, bump package and lockfile versions, commit/push, then publish a matching GitHub release. Manual dispatch publishes the selected ref and is **not a dry run**; the release-tag check only applies when a release tag is present. Do not dispatch publishing for an already published version. CI validates pushes to `main` and pull requests separately without publishing.
+- Valid coordinator worker calls arm/reset a five-minute reminder using fixed public text. Failed attempted operations can still need follow-up; incoming reports and read-only status queries do not reset the timer.
+- New coordinator-only `intercom_stop_reminders` disables reminders until the next qualifying worker call. No automatic reminder-count cutoff, worker retry, closure or publication is authorized.
+- Busy ticks are skipped without a backlog; stale callbacks and older in-flight calls are fenced. Shutdown/reload/session replacement clears ephemeral timer state.
+- Owning-run AbortSignal cancellation is supported where available, but is not universal detection of later Escape/Stop during separate retry/compaction runs.
+- Local validation: 183 tests, typecheck and isolated package-install checks. Update and reload the coordinator to activate the new tool; startup itself does not arm reminders.
 
 ### 0.6.1 Background handoff-and-close and quiet startup
 

package/dist/config.d.ts

@@ -11,11 +11,18 @@ export interface Agent {
     handoff?: Handoff;
     closeJob?: CloseJob;
 }
+export interface MonitorSettings {
+    autoOpen: boolean;
+    placement: 'coordinator-tab' | 'new-tab';
+}
 export interface Config {
     version: 1;
     multiplexer: 'herdr' | 'none';
     agents: Agent[];
+    monitor?: MonitorSettings;
 }
+export declare function monitorSettings(config: Config): MonitorSettings;
+export declare function validateMonitorSettings(value: unknown): asserts value is MonitorSettings;
 export declare const DEFAULT_DESCRIPTION = "Coordinate workers, delegate work, and manage shared configuration.";
 export declare const key: (name: string) => string;
 export declare function fail(message: string): never;
@@ -39,10 +46,15 @@ export declare class ConfigStore {
     private readonly options;
     readonly file: string;
     private tail;
+    private canonicalRoot?;
     constructor(root: string, options?: ConfigStoreOptions);
+    private assertLocalPaths;
+    validateRoot(expectedCanonicalRoot: string): Promise<void>;
     read(): Promise<Config>;
     static discover(cwd: string): Promise<ConfigStore | undefined>;
+    static workspace(cwd: string, workspaceRoot: string): Promise<ConfigStore>;
     protected openTemporary(file: string): Promise<import("fs/promises").FileHandle>;
+    private cleanupTemporary;
     private temporary;
     initialize(id: string, boundPort: number, assertValid?: () => void): Promise<boolean>;
     private publish;

package/dist/config.js

@@ -1,7 +1,15 @@
-import { mkdir, readFile, realpath, rename, unlink, open, link, stat } from 'node:fs/promises';
+import { mkdir, readFile, realpath, rename, unlink, open, link, stat, lstat } from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { fencedClose, validateHandoff, validateCloseJob } from './handoff.js';
+export function monitorSettings(config) {
+    return config.monitor ? { ...config.monitor } : { autoOpen: true, placement: 'coordinator-tab' };
+}
+export function validateMonitorSettings(value) {
+    const settings = value;
+    if (!settings || typeof settings !== 'object' || Array.isArray(settings) || typeof settings.autoOpen !== 'boolean' || !['coordinator-tab', 'new-tab'].includes(settings.placement) || Object.keys(settings).some(key => !['autoOpen', 'placement'].includes(key)))
+        fail('invalid monitor settings');
+}
 export const DEFAULT_DESCRIPTION = 'Coordinate workers, delegate work, and manage shared configuration.';
 export const key = (name) => name.toLowerCase();
 export function fail(message) { throw new Error(`PiIntercom: ${message}`); }
@@ -22,6 +30,8 @@ export function validateConfig(value) {
     const c = value;
     if (!c || c.version !== 1 || !['herdr', 'none'].includes(c.multiplexer) || !Array.isArray(c.agents))
         fail('invalid config schema/version');
+    if (c.monitor !== undefined)
+        validateMonitorSettings(c.monitor);
     const names = new Set(), ids = new Set();
     for (const a of c.agents) {
         if (!a || typeof a.coordinator !== 'boolean')
@@ -85,37 +95,97 @@ export class ConfigStore {
     options;
     file;
     tail = Promise.resolve();
+    canonicalRoot;
     constructor(root, options = {}) {
         this.root = root;
         this.options = options;
         this.file = path.join(root, '.pi-intercom', 'config.json');
     }
-    async read() {
-        // Missing, malformed and unreadable files propagate; never overwrite them.
-        return validateConfig(JSON.parse(await readFile(this.file, 'utf8')));
-    }
-    static async discover(cwd) {
-        let at = path.resolve(cwd);
-        for (;;) {
-            const store = new ConfigStore(at);
+    async assertLocalPaths() {
+        const root = await realpath(this.root);
+        if (this.canonicalRoot === undefined)
+            this.canonicalRoot = root;
+        else if (root !== this.canonicalRoot)
+            fail('config root canonical location changed');
+        // Reject existing escaping links/junctions before following them for any
+        // config access. These path checks are best effort, not TOCTOU protection.
+        for (const [location, directory] of [[path.dirname(this.file), true], [this.file, false]]) {
             try {
-                await store.read();
-                return store;
+                await lstat(location);
             }
             catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
+                if (error.code === 'ENOENT')
+                    continue;
+                throw error;
+            }
+            let resolved;
+            try {
+                resolved = await realpath(location);
+            }
+            catch {
+                fail('local config path cannot be resolved safely');
             }
-            const parent = path.dirname(at);
-            if (parent === at)
-                return undefined;
-            at = parent;
+            const relative = path.relative(root, resolved);
+            if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+                fail('local config path escapes session root');
+            const metadata = await stat(resolved);
+            if (directory ? !metadata.isDirectory() : !metadata.isFile())
+                fail('invalid local config path type');
+        }
+    }
+    async validateRoot(expectedCanonicalRoot) {
+        await this.assertLocalPaths();
+        if (this.canonicalRoot !== expectedCanonicalRoot)
+            fail('config root canonical location changed');
+    }
+    async read() {
+        // Missing, malformed and unreadable local files propagate; no fallback.
+        await this.assertLocalPaths();
+        return validateConfig(JSON.parse(await readFile(this.file, 'utf8')));
+    }
+    static async discover(cwd) {
+        const store = new ConfigStore(await realpath(cwd));
+        try {
+            await store.read();
+            return store;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return undefined;
         }
     }
+    static async workspace(cwd, workspaceRoot) {
+        text(workspaceRoot, 'workspaceRoot');
+        if (!path.isAbsolute(workspaceRoot))
+            fail('workspaceRoot must be absolute');
+        const root = await realpath(workspaceRoot);
+        if (!(await stat(root)).isDirectory())
+            fail('workspaceRoot is not a directory');
+        const current = await realpath(cwd);
+        if (path.relative(root, current) !== '')
+            fail('workspaceRoot must equal the session working directory; parent configs are forbidden');
+        const store = new ConfigStore(root);
+        await store.read(); // Explicit worker mode must never create a replacement coordinator.
+        return store;
+    }
     openTemporary(file) { return open(file, 'wx'); }
+    async cleanupTemporary(temp) {
+        // A moved root may leave an unpublished temp behind. Never follow a
+        // replacement parent outside the pinned root just to clean up. This guard
+        // is independent of lifecycle/deadline expiry so ordinary failures clean up.
+        await this.assertLocalPaths();
+        const resolved = await realpath(temp);
+        const relative = path.relative(this.canonicalRoot, resolved);
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+            fail('temporary config path escapes session root');
+        await unlink(temp);
+    }
     async temporary(config) {
         validateConfig(config);
+        await this.assertLocalPaths();
         await mkdir(path.dirname(this.file), { recursive: true });
+        await this.assertLocalPaths();
         const temp = `${this.file}.${randomUUID()}.tmp`;
         const handle = await this.openTemporary(temp);
         try {
@@ -127,7 +197,7 @@ export class ConfigStore {
         catch (error) {
             // Cleanup failures must not replace the original write/sync/close error.
             await handle.close().catch(() => { });
-            await unlink(temp).catch(() => { });
+            await this.cleanupTemporary(temp).catch(() => { });
             throw error;
         }
     }
@@ -137,6 +207,7 @@ export class ConfigStore {
         assertValid();
         const temp = await this.temporary({ version: 1, multiplexer: 'herdr', agents: [{ sessionId: id, name: 'Coordinator', coordinator: true, description: DEFAULT_DESCRIPTION, port: boundPort, projectDirectory: '.' }] });
         try {
+            await this.assertLocalPaths();
             assertValid();
             try {
                 await link(temp, this.file);
@@ -145,14 +216,14 @@ export class ConfigStore {
                 if (e.code !== 'EEXIST')
                     throw e;
                 await this.read();
-                await unlink(temp);
+                await this.cleanupTemporary(temp);
                 return false;
             }
-            await unlink(temp);
+            await this.cleanupTemporary(temp);
             return true;
         }
         catch (error) {
-            await unlink(temp).catch(() => { });
+            await this.cleanupTemporary(temp).catch(() => { });
             throw error;
         }
     }
@@ -167,6 +238,7 @@ export class ConfigStore {
             // of this already synced/closed temp, never the mutation or any OS action
             // outside config persistence. The elapsed budget bounds retry initiation,
             // not the duration of an already-submitted OS rename.
+            await this.assertLocalPaths();
             assertValid();
             if (attempt > 0 && now() - started >= RENAME_BUDGET_MS)
                 throw originalError;
@@ -201,7 +273,7 @@ export class ConfigStore {
                 await this.publish(temp, assertValid);
             }
             catch (error) {
-                await unlink(temp).catch(() => { });
+                await this.cleanupTemporary(temp).catch(() => { });
                 throw error;
             }
             return c;

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAA+B,MAAM,cAAc,CAAC;AAe3G,MAAM,CAAC,MAAM,mBAAmB,GAAG,qEAAqE,CAAC;AACzG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACxD,MAAM,UAAU,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;AACzH,CAAC;AACD,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK;QAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AACnG,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAC;AAChK,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,CAAC,GAAG,KAAe,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC3I,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,EAAE,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QACnH,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzF,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAE,CAAC;AAC7E,MAAM,UAAU,KAAK,CAAC,CAAS,EAAE,IAAY;IAC3C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,EAAU;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;AACtE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IAC7D,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACnK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAQD,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU,CAAC;AAChD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,OAAO,WAAW;IAGD;IAA+B;IAF3C,IAAI,CAAS;IACd,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,YAAqB,IAAY,EAAmB,UAA8B,EAAE;QAA/D,SAAI,GAAJ,IAAI,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAyB;QAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAAC,CAAC;IACrJ,KAAK,CAAC,IAAI;QACR,2EAA2E;QAC3E,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAW;QAC/B,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAAC,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YAAC,EAAE,GAAG,MAAM,CAAC;QACpF,CAAC;IACH,CAAC;IACS,aAAa,CAAC,IAAY,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,CAAC,SAAS,CAAC,MAAc;QACpC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,SAAiB,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChF,0EAA0E;QAC1E,+EAA+E;QAC/E,WAAW,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvN,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACpC,OAAO,CAAC,EAAE,CAAC;gBACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,KAAK,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACtE,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,WAAuB;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACtH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,IAAI,aAAsB,CAAC;QAC3B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,sDAAsD;YACtD,WAAW,EAAE,CAAC;YACd,IAAI,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,IAAI,gBAAgB;gBAAE,MAAM,aAAa,CAAC;YAC5E,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAC;gBAC9H,aAAa,KAAK,KAAK,CAAC;gBACxB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvC,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,OAAO,GAAG,OAAO,IAAI,gBAAgB;oBAAE,MAAM,aAAa,CAAC;gBAChG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAgD,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAC3G,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,oEAAoE;gBACpE,sDAAsD;gBACtD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YACpE,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAkC,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;YAC/B,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAClG,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9J,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,KAAK,GAAG,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC3B,CAAC;gBACJ,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,IAAI,CAAC,8DAA8D,CAAC,CAAC;gBACpG,IAAI,GAAG,CAAC,OAAO;oBAAE,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;gBACzC,IAAI,GAAG,CAAC,QAAQ;oBAAE,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtG,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAA+B,MAAM,cAAc,CAAC;AAgB3G,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AACnG,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,QAAQ,GAAG,KAAwB,CAAC;IAC1C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACtS,CAAC;AACD,MAAM,CAAC,MAAM,mBAAmB,GAAG,qEAAqE,CAAC;AACzG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACxD,MAAM,UAAU,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;AACzH,CAAC;AACD,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK;QAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AACnG,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAC;AAChK,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,CAAC,GAAG,KAAe,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC3I,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,EAAE,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QACnH,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzF,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAE,CAAC;AAC7E,MAAM,UAAU,KAAK,CAAC,CAAS,EAAE,IAAY;IAC3C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,EAAU;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;AACtE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IAC7D,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACnK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAQD,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU,CAAC;AAChD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,OAAO,WAAW;IAID;IAA+B;IAH3C,IAAI,CAAS;IACd,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,aAAa,CAAU;IAC/B,YAAqB,IAAY,EAAmB,UAA8B,EAAE;QAA/D,SAAI,GAAJ,IAAI,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAyB;QAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAAC,CAAC;IAC7I,KAAK,CAAC,gBAAgB;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;aAC3D,IAAI,IAAI,KAAK,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACrF,yEAAyE;QACzE,2EAA2E;QAC3E,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAU,EAAE,CAAC;YACnG,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAC9B,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YAChG,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAC5C,MAAM,CAAC;gBAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAC3I,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,qBAA6B;QAC9C,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,aAAa,KAAK,qBAAqB;YAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACnG,CAAC;IACD,KAAK,CAAC,IAAI;QACR,wEAAwE;QACxE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACzC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC1G,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,aAAqB;QACvD,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE;YAAE,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,oEAAoE;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IACS,aAAa,CAAC,IAAY,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,oEAAoE;QACpE,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAc,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC/I,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACO,KAAK,CAAC,SAAS,CAAC,MAAc;QACpC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,SAAiB,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChF,0EAA0E;QAC1E,+EAA+E;QAC/E,WAAW,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvN,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACpC,OAAO,CAAC,EAAE,CAAC;gBACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,KAAK,CAAC;YACrE,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACrF,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,WAAuB;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACtH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,IAAI,aAAsB,CAAC;QAC3B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,IAAI,gBAAgB;gBAAE,MAAM,aAAa,CAAC;YAC5E,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAC;gBAC9H,aAAa,KAAK,KAAK,CAAC;gBACxB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvC,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,OAAO,GAAG,OAAO,IAAI,gBAAgB;oBAAE,MAAM,aAAa,CAAC;gBAChG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAgD,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAC3G,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,oEAAoE;gBACpE,sDAAsD;gBACtD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YACnF,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAkC,EAAE,cAA0B,GAAG,EAAE,GAAE,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;YAC/B,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAClG,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC9J,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,KAAK,GAAG,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC3B,CAAC;gBACJ,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,IAAI,CAAC,8DAA8D,CAAC,CAAC;gBACpG,IAAI,GAAG,CAAC,OAAO;oBAAE,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;gBACzC,IAAI,GAAG,CAAC,QAAQ;oBAAE,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/core-monitor.d.ts

@@ -0,0 +1,30 @@
+import { type CoreCall } from './herdr-core.js';
+export type CoreMonitorPlacement = 'coordinator-tab' | 'new-tab';
+export interface CoreMonitorOptions {
+    root: string;
+    sessionId: string;
+    script: string;
+    node?: string;
+    env?: NodeJS.ProcessEnv;
+    platform?: string;
+    placement?: CoreMonitorPlacement;
+    call?: CoreCall;
+    assertCurrent?(): void;
+}
+export interface CoreMonitorResult {
+    outcome: string;
+    pane?: string;
+    terminal?: string;
+}
+/** Explicit open only. This edits the local core's machine-owned document; a
+ * remote Windows app qualifies its IDs when projecting it. No app commands,
+ * window launch, focus changes, terminal labels for auto-adoption, or retries.
+ * Success proves shared data, NOT attached-window rendering or process readiness. */
+export declare function ensureCoreMonitorPane(options: CoreMonitorOptions): Promise<CoreMonitorResult>;
+/** Best-effort owned-monitor close: reject existing live descendants, persist a
+ * fence, recheck identity and inventory, stop once, then remove only its pane.
+ * Core completion may cascade to die_with_parent children; other clients must
+ * not concurrently attach children to this owned monitor. This is not an atomic
+ * child-registration barrier or an all-descendants guarantee. Uncertainty stays
+ * fenced and never authorizes replay. No whole-tab close command is issued. */
+export declare function closeCoreMonitorPane(options: CoreMonitorOptions): Promise<CoreMonitorResult>;